Community
$0
Free
For anyone defending or researching AI infrastructure.
- Public IOC feeds: JSON, TXT, STIX 2.1, MISP
- Actor category and ATT&CK techniques per indicator
- The weekly brief by email
- The live dashboard and research blog
AI-infrastructure attack intelligence
What attackers do after an exposed AI service answers.
We run decoys of self-hosted AI services that answer like the real thing: model servers, LLM gateways, OpenAI-compatible proxies, vector databases and MCP endpoints. You get the indicators and the behaviour behind them (model enumeration, API-key testing, agent tasking and first sightings on AI-product paths), with verified research scanners counted separately from threats.
- Data since 26 April 2026
- Free feeds, no sign-up
- No prompt text or key values in any feed
- Buy and get support by email, no sales calls
Collection totals
4.2M+Requests captured by our decoys
1.4M+Prompts sent to decoy models (counted, never published)
77,000+Distinct source IPs
26 Apr 2026Collection start
Totals as of 30 October 2026.
What the data shows
Numbers you can check, each with its window
~540
never-seen source IPs reach our decoy AI services each day.
Daily average, 23–29 Oct 2026 (range 446–690)
1,674
IPs called model-listing endpoints on our decoys, 267,656 calls in total.
30 days to 30 Oct 2026
2 days
after CVE-2026-42271 (LiteLLM) was added to CISA's KEV catalog, the first request for its endpoints reached our decoys. October brought six times the June–August total.
41 requests Jun–Aug; 249 from 9 IPs, 1–29 Oct 2026
3.0%
of captures came from verified research scanners (5.9% of source IPs). We verify them by network owner or forward-confirmed reverse DNS, never by user agent.
30 days to 30 Oct 2026Every figure comes from a read-only, time-bounded query that we re-run before each update. Decoys answer, so they draw deeper sessions than ordinary hosts: use this data for what attackers do and with what tools, not for internet-wide prevalence rates.
Why it's different
Built for the step after the scan
Application layer, not port touches
A scan-level view shows that an IP touched a port. Our decoys answer as Ollama, vLLM, LiteLLM, OpenAI-compatible proxies, vector databases and MCP servers, so we see the requests, model names and payload families that follow.
Behaviour on every indicator
Each indicator carries an actor category and ATT&CK techniques. The Attacker Behaviour add-on adds prompt-family mix, model-enumeration patterns and actor timelines, derived from the data, with no prompt text.
Census scanners counted apart
Internet-census and research scanners are verified and reported separately from threats, so research traffic isn't sold to you as attacks.
Honest about the data
History starts on 26 April 2026. We publish concentration (in the 30 days to 30 October 2026, the top 10 source IPs sent 45% of captures) and write “consistent with”, not “proves”.
Products
What you can use
Free
IOC feeds
Source IPs seen on our decoy AI services, with actor category, ATT&CK techniques and behaviour context. JSON, TXT, STIX 2.1 and MISP. No sign-up.
Get the free feed →
Pro
Pro feed and API
90 days of history, CSV plus the actor and campaign API, a commercial licence for internal use, and the full weekly brief with its IOC appendix.
Full feed →
Add-on
Attacker Behaviour
Derived behaviour labels per indicator: prompt-family mix, model-enumeration pattern, agent fingerprints and actor timelines. The add-on carries no prompt text.
Included in the Full feed trial →
Enterprise
Enterprise and Zenith
All history since 26 April 2026, a daily bulk export, higher limits and priority support. Zenith adds the rights MSSPs, platforms and OEMs need to share the data with their clients, by application.
Order a pilot →
Service
Custom research
One question answered in writing, up to five analyst-days, with the derived data behind the answer. Fixed price.
Request custom research →
Free
Live dashboard
The public dashboard: capture volume, targeted AI services and requested models, updated as data arrives.
Open the live dashboard →Pricing
Published prices, in US dollars
Start free, try the Full feed for 14 days with no card, or order a 90-day pilot. Every plan is bought and supported in writing, so there's no call to book.
Pro
$299 / month
or $2,990 / year (two months free)
For SOC, threat-intel and MSSP teams using the data inside their organisation.
- 90 days of history
- STIX 2.1, MISP, JSON, TXT and CSV
- Actor and campaign API
- 3 API keys, 10,000 requests a day
- Commercial licence for internal use
- Full weekly brief with IOC appendix
- Email support within 2 business days
Enterprise
$15,000 / year
Annual contract, invoiced
For larger threat-intel teams, platforms and AI providers.
- Everything in Pro
- All history since 26 April 2026
- Daily bulk export
- Attacker Behaviour add-on included
- 10 API keys, 100,000 requests a day
- Priority email support within 1 business day
- Quarterly written threat briefing, with a captioned screen recording
- 99.5% availability target (no service credits in year one)
Zenith
Custom
Annual agreement, by application
For MSSPs, MDR providers, platforms and OEMs, and for agreements built to your scope.
- Everything in Enterprise
- Rights to push indicators to your clients or embed them in your product
- Custom data cuts on your schedule
- Research time reserved for your questions
- Private written briefings for your team
- White-label briefs for your clients
- Support and availability terms written into your agreement
Attacker Behaviour add-on
+$149 / month or +$1,490 / year
Adds derived behaviour labels to Pro. Free during the Pro trial and included in Enterprise.
90-day paid pilot
$2,500 for Enterprise
Enterprise data and limits for 90 days. The fee is credited to your first year if you sign within 30 days of the pilot's end. Pilot pricing is for our first five Enterprise pilot customers, signed by 31 December 2026. MSSP and redistribution pilots are part of Zenith.
Custom research (RFI)
$4,000 fixed
One question, up to five analyst-days, answered in writing with the derived data behind it.
First five Pro customers
$149 / month for six months, then $299
Monthly billing only, not combined with annual pricing, in return for two short written feedback forms (day 30 and month 5). We offer it by email during your Full feed trial, until five customers have taken it or 31 December 2026.
Quarterly threat briefing
$1,500 each for Pro · included in Enterprise
A written briefing on what changed in your area of interest, with a captioned screen recording. Follow-up questions are answered in writing.
White-label monthly brief
+$750 / month, Enterprise add-on
Our monthly AI-threat brief under your brand, for your client reports.
We're launching now. Card checkout and automatic API keys aren't live yet. Request the Full feed or order a pilot with the short form, or write to contact@ai-honeypots.com, and we reply in writing with next steps. The free feeds work today, with no sign-up.
Who it's for
Teams that defend, sell or study AI infrastructure
MSSPs and MDR providers
Your clients are standing up Ollama, vLLM, LiteLLM and vector databases, and asking whether you cover AI. Get AI-infrastructure indicators with behaviour context in STIX 2.1 and MISP, a licence to push them into client environments, and a weekly brief your client reports can draw on.
Best fit: Zenith Request access →Threat-intel platforms and data vendors
First-party data from decoy AI services, collected since 26 April 2026, with actor category, ATT&CK techniques and behaviour fields on each indicator. Available as an OEM or marketplace feed.
Best fit: Enterprise, or Zenith for OEM and marketplace use Order a pilot →AI platforms, inference APIs and gateways
See the infrastructure behind API-key testing and model enumeration. We report infrastructure, never keys: captured keys are never sold, shared or tested.
Best fit: Pro with the Attacker Behaviour add-on Full feed →SOC and threat-intel teams at AI-heavy companies
If your teams self-host models, gateways, vector databases or MCP servers, these are the attacks waiting for them. Get indicators to block, AI-product paths to watch, and a weekly brief your platform and SOC teams can act on.
Best fit: Pro Full feed →Researchers and universities
Attacker behaviour against AI infrastructure since 26 April 2026. Use the free feeds now. We're finalising terms for derived research data under a data-use agreement.
Ask about research access →How buying works
Everything in writing, no calls to book
Every answer is exact, sourced and on record for both sides.
-
Start free
Pull the IOC feeds today. No account and no key needed.
-
Try the Full feed for 14 days
Send the short Full feed request and we reply by email to set it up. The 14 days start when your key arrives. No card is needed, it's one trial per organisation every 90 days, and the Attacker Behaviour add-on is included. If you don't subscribe, the key keeps working on the free plan.
-
Order a pilot or Enterprise
Use the order form with the plan, start date and billing contact. We confirm scope in writing, then send the agreement and an invoice, due on receipt. Keys go out when it's paid, and your 90 days start that day. MSSPs, platforms and OEMs can request Zenith access.
-
Security review in writing
Send your security questionnaire or DPA and we answer in writing. We don't hold a SOC 2 report, and we say so up front.
Full feed, pilots and Zenith
Request the Full feed, order a pilot or apply for Zenith
Tell us what you need. We reply by email, usually within one business day. No calls to book.
Free resources
Use the data before you buy
IOC feeds
JSON, TXT, STIX 2.1 and MISP. No sign-up.
Get the free feed →Weekly AI-threat brief
New actors, AI-product paths worth watching and defender actions, by email each week. Unsubscribe any time.
Get the weekly brief →Attack research
Write-ups of real attacks on decoy AI services, with indicators.
Read the research →Live dashboard
Capture volume, targeted AI services and requested models.
Open the live dashboard →Latest research
- CyberStrikeAI Meets the Honeypots: When Offensive AI Tools Get Some HoneyAn AI pentest platform pointed offensive tooling and jailbreak strategies at our decoy AI API. What it tried and how to spot it.
- Turtles All the Way Down: An Attacker Used Our Honeypot to Build a Honeypot ScannerA user of a free-looking Ollama endpoint asked it for malware tooling, then for a scanner to find more exposed Ollama servers.
- Stealing AI With AI: Catching an Infrastructure Pirate Mid-HeistAn operator routed a proxy panel, a jailbreak framework and a catalogue of stolen AI endpoints through our decoy. How exposed AI servers get resold.
FAQ
Questions buyers ask
Isn't this just scanner noise?
No. Scan-level intel tells you who touched a port. We record what happens after an AI service answers: model enumeration, key testing, agent tasking and AI-product paths. Verified research scanners were 3.0% of our captures in the 30 days to 30 October 2026, and we count them separately. Many teams use both kinds of intel.
How far back does the data go?
To 26 April 2026, about six months. Pro includes 90 days of history and Enterprise includes all of it. We never claim older data.
Do you sell prompts or captured API keys?
No. Feeds and plans carry no prompt text; paid plans add derived labels and counts. Captured API keys and tokens are never sold, shared or tested, in any plan, and go only to the provider that issued them. Any future access to redacted text would only be under a vetted, defensive-use licence after legal review. It isn't offered today.
Where are your sensors, and how many do you run?
We don't disclose our decoy footprint. That protects the data's value to everyone who uses it. We're happy to explain our method and data quality in writing.
Is this representative of the whole internet?
No, and we don't claim it is. Decoys answer, so they draw deeper sessions than ordinary hosts. Use the data for what attackers do and with what tools, not for internet-wide prevalence rates.
Isn't most of the volume a few heavy hitters?
Yes, and we publish it: in the 30 days to 30 October 2026, the top 10 source IPs sent 45% of captures. We sell actors and behaviour, not capture counts.
Do we need a call or a demo to buy?
No. We work in writing, so every answer is exact, sourced and on record. Email your questions to contact@ai-honeypots.com. To see the data, use the free feed or request the Full feed.
How do pilots work?
A 90-day paid pilot of Enterprise costs $2,500. Success criteria go into the pilot letter, and the fee is credited to your first year if you sign within 30 days of the pilot's end. MSSP and redistribution pilots are part of Zenith. Order a pilot.
What is Zenith?
Zenith is our tier for MSSPs, MDR providers, platforms and OEMs, and for anything built to your scope: rights to share the data with your clients, custom data cuts, reserved research time, private written briefings, white-label briefs, and support terms written into your agreement. It's priced to scope. Request access and we reply in writing, usually within one business day. Everything stays in writing.
How can we pay?
Pro and the add-on: by card at checkout, monthly or annually, and annual Pro can also be invoiced. Enterprise, pilots and services: by invoice, paid by ACH, bank transfer or card. Prices are in US dollars.
Can we use a purchase order?
Yes. Send the PO number with your order details and we show it on the invoice. Pilot invoices are due on receipt, and your data starts when the invoice is paid.
Can you answer our security questionnaire?
Yes, in writing. Send it in your format (SIG Lite, CAIQ or your own). We don't hold a SOC 2 report. Enterprise has a 99.5% availability target with no service credits in year one.
Who is behind the attacks you see?
We don't attribute activity to named groups or countries. We report infrastructure, behaviour and timing, and write “consistent with”, not “proves”.
Start in writing
Pick the path that fits. The Full feed, pilot and Zenith buttons open a short form; the others open a pre-filled email to contact@ai-honeypots.com. The AI Honeypots research team answers either way.